Privacy Policy

Cannahaus ("we", "us", "our") is committed to protecting the privacy of everyone who uses our website at cannahaus.de.com ("the Site"). This Privacy Policy explains what data we collect, how we use it, and your rights under EU GDPR (DSGVO) and Germany Federal Data Protection Act (BDSG).

1. What Data We Collect

We collect only the minimum personal data necessary to process your order and deliver it to you:

• Order data: Your name, email address, delivery address, and postal code (PLZ)
• Contact data: If you contact us via email or our contact form, we retain the content of that communication
• Newsletter data: Your email address if you subscribe to our mailing list
• Usage data: Standard server logs including your IP address and browser type (retained for 30 days only)

We do not collect payment card data (we accept cryptocurrency only), date of birth, national insurance numbers, or any special category data under EU GDPR (DSGVO).

2. How We Use Your Data

• To process and fulfil your order (lawful basis: contract)
• To contact you about your order if there is a problem (lawful basis: contract)
• To send you the newsletter if you have opted in (lawful basis: consent)
• To respond to support enquiries (lawful basis: legitimate interest)
• To comply with legal obligations (lawful basis: legal obligation)

3. Data Sharing

We do not sell, rent or trade your personal data. We share data only with the following service providers, solely for the purpose of fulfilling your order:

• Supabase Inc. — database hosting (USA, with EU Standard Contractual Clauses)
• Resend Inc. — transactional email delivery (USA, with EU Standard Contractual Clauses)
• DHL Paket GmbH — parcel delivery (German)

We do not share your data with any advertising networks, data brokers, or third parties for marketing purposes.

4. Data Retention

• Order records are retained for 6 years for legal and accounting purposes
• Contact form submissions are retained for 12 months then deleted
• Newsletter subscriptions are retained until you unsubscribe
• Server logs are retained for 30 days then deleted automatically

5. Your Rights

Under EU GDPR (DSGVO), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to processing of your data
• Request portability of your data
• Withdraw consent at any time (for newsletter subscriptions)

To exercise any of these rights, email us at orders@cannahaus.de.com. We will respond within 30 days.

6. Cookies

We use only essential session storage and localStorage for cart functionality and age verification. We do not use advertising cookies, analytics cookies, or any tracking cookies that follow you across the web.

7. Security

All data is transmitted over HTTPS. Access to customer data is restricted to authorised personnel only and protected by multi-factor authentication. We conduct regular security reviews of our systems.

8. Cryptocurrency & Payments

We accept payment in Bitcoin only. Blockchain transactions are publicly recorded on the respective blockchain networks. We have no control over and no responsibility for blockchain data. No card or bank account data is ever transmitted to or stored by us.

9. Children

Our Site is not directed at persons under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice on our Site. Continued use of the Site after changes constitutes acceptance of the updated policy.

11. Contact & Complaints

For any privacy questions, contact us at orders@cannahaus.de.com. If you are unsatisfied with our response, you have the right to lodge a complaint with the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) at bfdi.bund.de.